Søg
Avatar billede nicolehodal Nybegynder
29. februar 2004 - 12:57 Der er 13 kommentarer og
1 løsning

hijackthis - hvad skal slettes

Jeg har problemer med at regedit lukker og skrivebordsikoner og startbjælken er væk?
kan i hjælpe?

Logfile of HijackThis v1.97.7
Scan saved at 12:45:44, on 29-02-2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\winaccess.exe
C:\WINDOWS\System32\ieplore32.exe
C:\WINDOWS\system32\pctspk.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmer\Internet Explorer\iexplore.exe
C:\hjt.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = file:///C:/Hjemmeside/startside.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://aifind.info/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://contexualsearch.com/searchbar.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://contexualsearch.com/searchbar.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://contexualsearch.com/searchbar.html
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://signon.stofanet.dk/proxy.pac
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = www.signon.stofanet.dk
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O1 - Hosts: 205.177.124.66 auto.search.msn.com
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {481AA93B-592F-F6AA-46EB-AE002C6FC513} - C:\PROGRA~1\TONSPR~1\buildshim.dll
O2 - BHO: (no name) - {4E7BD74F-2B8D-469E-C0FF-FD60B590A87D} - C:\PROGRA~1\FLLESF~1\Real\Toolbar\realbar.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: REALBAR - {4E7BD74F-2B8D-469E-C0FF-FD60B590A87D} - C:\PROGRA~1\FLLESF~1\Real\Toolbar\realbar.dll
O3 - Toolbar: Base Enc Camp - {47191C28-E744-509C-AE55-91F85E8D4FCD} - C:\PROGRA~1\TONSPR~1\buildshim.dll
O4 - HKLM\..\Run: [TkBellExe] "C:\Programmer\Fælles filer\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Mirabilis ICQ] C:\PROGRA~1\ICQ\ICQNet.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmer\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Winsock32driver] svchhost.exe
O4 - HKLM\..\Run: [Services] C:\hgsfgj.exe
O4 - HKLM\..\Run: [Internet Explorer] ieplore32.exe
O4 - HKLM\..\Run: [pingscr] C:\PROGRA~1\blue active locks\pop memo.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Programmer\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [Configuration Loader] winaccess.exe
O4 - HKLM\..\RunServices: [Internet Explorer] ieplore32.exe
O4 - HKLM\..\RunServices: [Configuration Loader] winaccess.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programmer\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [od-padr97] c:\Webdialer\od-stnd174.exe -m
O4 - HKCU\..\Run: [sws.exe] c:\\GlobalDialer\domer00083\gd-dial.exe -remove
O4 - HKCU\..\Run: [od-gays33] c:\program files\Webdialer\od-gays33.exe -m
O4 - HKCU\..\Run: [LDM] C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - HKCU\..\Run: [Configuration Loader] winaccess.exe
O4 - HKLM\..\RunOnce: [Configuration Loader] winaccess.exe
O4 - HKCU\..\RunOnce: [Configuration Loader] winaccess.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Programmer\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programmer\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: ICQ Pro (HKLM)
O9 - Extra 'Tools' menuitem: ICQ (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Messenger (HKLM)
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB
O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/20031024/qtinstall.info.apple.com/abarth/dk/win/QuickTimeFullInstaller.exe
O16 - DPF: {6F750200-1362-4815-A476-88533DE61D0C} (Ofoto Upload Manager Class) - http://www.ofoto.com/downloads/BUM/BUM_WIN_IE_1/axofupld.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2003120501/housecall.antivirus.com/housecall/xscan53.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38003.4786342593
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O19 - User stylesheet: C:\WINDOWS\hh.htt (HKLM)
Avatar billede arlet Juniormester
29. februar 2004 - 12:58 #1
løber den igennem
Avatar billede arlet Juniormester
29. februar 2004 - 13:14 #2
Fandt da lidt*S*

Du skal nu til at i gang med at fixe:

Deaktiver systemgendannelse:
http://www.arlet.dk/systemgendannelsen.htm

Kør Hijackthis, scan, sæt flueben ved linierne listet her, luk alle vinduer undtaget Hijackthis, klik på fix checked, luk hijackthis igen.
Dobbelttjek, så alt kommer med.



R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = file:///C:/Hjemmeside/startside.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://aifind.info/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://contexualsearch.com/searchbar.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://contexualsearch.com/searchbar.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://contexualsearch.com/searchbar.html

O1 - Hosts: 205.177.124.66 auto.search.msn.com

O2 - BHO: (no name) - {481AA93B-592F-F6AA-46EB-AE002C6FC513} - C:\PROGRA~1\TONSPR~1\buildshim.dll
O2 - BHO: (no name) - {4E7BD74F-2B8D-469E-C0FF-FD60B590A87D} - C:\PROGRA~1\FLLESF~1\Real\Toolbar\realbar.dll

O3 - Toolbar: REALBAR - {4E7BD74F-2B8D-469E-C0FF-FD60B590A87D} - C:\PROGRA~1\FLLESF~1\Real\Toolbar\realbar.dll
O3 - Toolbar: Base Enc Camp - {47191C28-E744-509C-AE55-91F85E8D4FCD} - C:\PROGRA~1\TONSPR~1\buildshim.dll

O4 - HKLM\..\Run: [TkBellExe] "C:\Programmer\Fælles filer\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Winsock32driver] svchhost.exe
O4 - HKLM\..\Run: [Services] C:\hgsfgj.exe
O4 - HKLM\..\Run: [Internet Explorer] ieplore32.exe
O4 - HKLM\..\Run: [Configuration Loader] winaccess.exe
O4 - HKLM\..\RunServices: [Internet Explorer] ieplore32.exe
O4 - HKLM\..\RunServices: [Configuration Loader] winaccess.exe
O4 - HKCU\..\Run: [od-padr97] c:\Webdialer\od-stnd174.exe -m
O4 - HKCU\..\Run: [sws.exe] c:\\GlobalDialer\domer00083\gd-dial.exe -remove
O4 - HKCU\..\Run: [od-gays33] c:\program files\Webdialer\od-gays33.exe -m
O4 - HKCU\..\Run: [LDM] C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - HKCU\..\Run: [Configuration Loader] winaccess.exe
O4 - HKLM\..\RunOnce: [Configuration Loader] winaccess.exe
O4 - HKCU\..\RunOnce: [Configuration Loader] winaccess.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Programmer\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programmer\Microsoft Office\Office10\OSA.EXE

O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000

O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab

O19 - User stylesheet: C:\WINDOWS\hh.htt (HKLM)

-----------------------------------------------------
kender du denne, ellers fix:
O4 - HKLM\..\Run: [pingscr] C:\PROGRA~1\blue active locks\pop memo.exe




--------------------------------------------------------------------

Åbn en tilfældig mappe, klik på Funktioner=>Mappeindstillinger=>Vis.
Fjern flueben ved "Skjul beskyttede operativsystemfiler".
Fjern flueben ved "Skjul filtypenavne for kendte filtyper".
Sæt prik i "Vis skjulte filer og mapper".

--------------------------------------------------------------------

Find og slet i fejlsikret(f8 ved opstart):



C:\WINDOWS\System32\winaccess.exe
C:\WINDOWS\System32\ieplore32.exe
C:\Programmer\Fælles filer\Real\Update_OB\realsched.exe
C:\hgsfgj.exe
c:\Webdialer <- hele mappen
c:\\GlobalDialer <- hele mappen
c:\program files\Webdialer <- hele mappen
C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
C:\Programmer\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe



---------------------------------------------------
Kender du denne her: eller slet:
C:\PROGRA~1\blue active locks\pop memo.exe


Derefter genstarter du og sender en ny log herind, for at se om vi har fået den helt ren.
Først når din log er endelig godkendt, må du aktiver din systemgendannelse igen.
Avatar billede arlet Juniormester
29. februar 2004 - 13:47 #3
Ja, din startside kom lige med som filer du skulle fixe:
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = file:///C:/Hjemmeside/startside.htm

Det lader du selvfølgelig være!!
Avatar billede nicolehodal Nybegynder
29. februar 2004 - 22:04 #4
vi har nu fuldt instruktionerne.
og alt er gjort på nær
O4 - HKLM\..\Run: [Configuration Loader] winaccess.exe
c:\Webdialer <- hele mappen
c:\\GlobalDialer <- hele mappen
c:\program files\Webdialer <- hele mappen

er alt ok nu?

Logfile of HijackThis v1.97.7
Scan saved at 22:00:39, on 29-02-2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Programmer\QuickTime\qttask.exe
C:\Programmer\Logitech\iTouch\iTouch.exe
C:\WINDOWS\System32\explore.exe
C:\Programmer\Messenger\msmsgs.exe
C:\WINDOWS\System32\SVCHST.EXE
C:\Programmer\Logitech\MouseWare\system\em_exec.exe
C:\PROGRA~1\ICQ\ICQ.exe
C:\WINDOWS\System32\svchost2.exe
C:\WINDOWS\system32\pctspk.exe
C:\WINDOWS\System32\svchost.exe
C:\hjt.exe
C:\WINDOWS\System32\wuauclt.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = file:///C:/Hjemmeside/startside.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://signon.stofanet.dk/proxy.pac
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = www.signon.stofanet.dk
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O1 - Hosts: 205.177.124.66 auto.search.msn.com
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Reader\ActiveX\AcroIEHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [Mirabilis ICQ] C:\PROGRA~1\ICQ\ICQNet.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmer\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Programmer\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [Configuration Loader] svchost2.exe
O4 - HKLM\..\Run: [svchost service] SVCHST.EXE
O4 - HKLM\..\Run: [Video Service] explore.exe
O4 - HKLM\..\RunServices: [Configuration Loader] svchost2.exe
O4 - HKLM\..\RunServices: [Video Service] explore.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programmer\Messenger\msmsgs.exe" /background
O4 - HKCU\..\RunOnce: [svchost service] SVCHST.EXE
O9 - Extra button: ICQ Pro (HKLM)
O9 - Extra 'Tools' menuitem: ICQ (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Messenger (HKLM)
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB
O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/20031024/qtinstall.info.apple.com/abarth/dk/win/QuickTimeFullInstaller.exe
O16 - DPF: {6F750200-1362-4815-A476-88533DE61D0C} (Ofoto Upload Manager Class) - http://www.ofoto.com/downloads/BUM/BUM_WIN_IE_1/axofupld.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2003120501/housecall.antivirus.com/housecall/xscan53.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38003.4786342593
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O19 - User stylesheet: C:\WINDOWS\hh.htt (HKLM)
Avatar billede arlet Juniormester
29. februar 2004 - 22:08 #5
Ikke helt.

fix i hijackthis:
O1 - Hosts: 205.177.124.66 auto.search.msn.com
O4 - HKLM\..\Run: [Configuration Loader] svchost2.exe
O4 - HKLM\..\Run: [svchost service] SVCHST.EXE
O4 - HKLM\..\Run: [Video Service] explore.exe
O4 - HKLM\..\RunServices: [Configuration Loader] svchost2.exe
O4 - HKLM\..\RunServices: [Video Service] explore.exe
O4 - HKCU\..\RunOnce: [svchost service] SVCHST.EXE

find og slet:
C:\WINDOWS\System32\explore.exe
C:\WINDOWS\System32\SVCHST.EXE
C:\WINDOWS\System32\svchost2.exe

genstart og ny log
Avatar billede nicolehodal Nybegynder
29. februar 2004 - 22:35 #6
Så skulle de gerne være klaret.
Er det ok nu?

Logfile of HijackThis v1.97.7
Scan saved at 22:33:13, on 29-02-2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Programmer\QuickTime\qttask.exe
C:\Programmer\Logitech\iTouch\iTouch.exe
C:\Programmer\Messenger\msmsgs.exe
C:\Programmer\Logitech\MouseWare\system\em_exec.exe
C:\PROGRA~1\ICQ\ICQ.exe
C:\WINDOWS\system32\pctspk.exe
C:\WINDOWS\System32\svchost.exe
C:\hjt.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = file:///C:/Hjemmeside/startside.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://signon.stofanet.dk/proxy.pac
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = www.signon.stofanet.dk
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Reader\ActiveX\AcroIEHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [Mirabilis ICQ] C:\PROGRA~1\ICQ\ICQNet.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmer\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Programmer\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [svchost service] SVCHST.EXE
O4 - HKCU\..\Run: [MSMSGS] "C:\Programmer\Messenger\msmsgs.exe" /background
O9 - Extra button: ICQ Pro (HKLM)
O9 - Extra 'Tools' menuitem: ICQ (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Messenger (HKLM)
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB
O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/20031024/qtinstall.info.apple.com/abarth/dk/win/QuickTimeFullInstaller.exe
O16 - DPF: {6F750200-1362-4815-A476-88533DE61D0C} (Ofoto Upload Manager Class) - http://www.ofoto.com/downloads/BUM/BUM_WIN_IE_1/axofupld.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2003120501/housecall.antivirus.com/housecall/xscan53.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38003.4786342593
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O19 - User stylesheet: C:\WINDOWS\hh.htt (HKLM)
Avatar billede fromsej Praktikant
29. februar 2004 - 22:39 #7
O4 - HKLM\..\Run: [svchost service] SVCHST.EXE
O19 - User stylesheet: C:\WINDOWS\hh.htt (HKLM)
Skal fixes, genstart og så en ny, forhåbentlig sidste log.
Avatar billede nicolehodal Nybegynder
29. februar 2004 - 22:45 #8
Håber den er der nu?

Logfile of HijackThis v1.97.7
Scan saved at 22:44:57, on 29-02-2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Programmer\QuickTime\qttask.exe
C:\Programmer\Logitech\iTouch\iTouch.exe
C:\Programmer\Messenger\msmsgs.exe
C:\Programmer\Logitech\MouseWare\system\em_exec.exe
C:\PROGRA~1\ICQ\ICQ.exe
C:\WINDOWS\system32\pctspk.exe
C:\WINDOWS\System32\svchost.exe
C:\hjt.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = file:///C:/Hjemmeside/startside.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://signon.stofanet.dk/proxy.pac
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = www.signon.stofanet.dk
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Reader\ActiveX\AcroIEHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [Mirabilis ICQ] C:\PROGRA~1\ICQ\ICQNet.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmer\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Programmer\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programmer\Messenger\msmsgs.exe" /background
O9 - Extra button: ICQ Pro (HKLM)
O9 - Extra 'Tools' menuitem: ICQ (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Messenger (HKLM)
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB
O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/20031024/qtinstall.info.apple.com/abarth/dk/win/QuickTimeFullInstaller.exe
O16 - DPF: {6F750200-1362-4815-A476-88533DE61D0C} (Ofoto Upload Manager Class) - http://www.ofoto.com/downloads/BUM/BUM_WIN_IE_1/axofupld.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2003120501/housecall.antivirus.com/housecall/xscan53.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38003.4786342593
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
Avatar billede fromsej Praktikant
29. februar 2004 - 22:52 #9
Ja, så er din log ren og du kan genaktivere din systemgendannelse.
For at holde den ren har vi sammensat en pakke med små nyttige programmer.
http://www.eksperten.dk/artikler/144
Som minimum anbefaler jeg Spywareguard, Spywareblaster, IE-Spyad og IE Privacy Keeper.
Mvh:
Fromsej/Team Spywarefri.
PS:
Pointene giver du bare til Arlet, han har lavet langt det meste.*S*
Avatar billede nicolehodal Nybegynder
29. februar 2004 - 23:01 #10
okay mange tak for hjælpen begge to.
hvordan giver man point videre?
Avatar billede fromsej Praktikant
29. februar 2004 - 23:17 #11
Du venter på at Arlet svarer, så kan du give ham point.
Avatar billede arlet Juniormester
01. marts 2004 - 13:18 #12
Og det kom her*S*
Avatar billede nicolehodal Nybegynder
01. marts 2004 - 15:36 #13
og du får selvfølgelig de 30 point, de er fuldt ud fortjent, du burde få flere!
Mange tak for hjælpen!
Avatar billede arlet Juniormester
01. marts 2004 - 18:55 #14
Velbekommen
Avatar billede Ny bruger Nybegynder

Din løsning...

Tilladte BB-code-tags: [b]fed[/b] [i]kursiv[/i] [u]understreget[/u] Web- og emailadresser omdannes automatisk til links. Der sættes "nofollow" på alle links.

Loading billede Opret Preview
Kategori
Se alle it-kurser fra Computerworld Kurser
IT-kurser om Microsoft 365, sikkerhed, personlig vækst, udvikling, digital markedsføring, grafisk design, SAP og forretningsanalyse.
Se alle it-kurser

Flere spørgsmål fra Windows kategorien

Titel Indlæg Oprettet Seneste aktivitet
Download af Win 11 vi aRufus Af lbc i Windows 2 I går 14:06 I går 20:19
oprette et installationsmedie Af Malm i Windows 4 16/09/202618:13 23/09/202617:38
Popup ved opstart Af mort1 i Windows 1 06/09/202611:21 06/09/202611:31
Slet lokal konto Af ErikHg i Windows 9 04/09/202618:50 07/09/202615:51
Dette er ikke en kommerciel session i Windows 11 Af eksmojo i Windows 3 04/09/202613:47 05/09/202622:31
Se alle spørgsmål i kategorien Opret spørgsmål

Log ind eller opret profil

Hov!

For at kunne deltage på Computerworld Eksperten skal du være logget ind.

Det er heldigvis nemt at oprette en bruger: Det tager to minutter og du kan vælge at bruge enten e-mail, Facebook eller Google som login.

Opret Log ind

Du kan også logge ind via nedenstående tjenester

Alle kategorier på Eksperten
Seneste spørgsmål Seneste aktivitet
I dag 13:01 Måned og år på graf Af mort1 i Excel
I dag 12:28 2 diske Af dcedata1977 i Andet hardware
I dag 12:06 Ekstra til TV 2 : "Tilkøb" + "TV2 Ude" Af Ikke-ekspert i Fjernsyn & projektorer
I dag 10:20 ASP classic kopiere database fil på server Af bsn i ASP
I går 15:04 Kan Medie Player overspille en CD ? - Hvordan Af Ikke-ekspert i Musik & videoafspillere
White papers
Flere white papers »